Universities Get Schooled by Hackers

Colleges and universities are prime targets for criminals due to huge sets of personal information and security that is weaker than in many businesses.

As university students leave campus for holiday breaks, they may carry more than new knowledge home to family and friends. Recent research points out that colleges and universities are coming under more aggressive security attacks while their defenses struggle to keep up with growing demand.

In "Defending Networks at Higher Learning Institutions — Heroes Needed," a report issued earlier this fall, researchers at InfoBlox pointed out that the complexity of the university network environment makes effective defense difficult. "Years ago we planned 'one jack per pillow,' and that's changed in such a short period of time," says Victor Danevich, Infoblox CTO. He believes that each student on campus represents approximately seven IP addresses, making most state and many private universities the home of hundreds of thousands of connected devices.

And while the complexity and levels of attacks are growing, the issues in higher education cybersecurity aren't new. A report released by EdGuards, "A Brief History of Higher Education Insecurity," walks readers through attacks from 2002 through 2018 to show how hackers have evolved. One of the growing issues is the size of the databases sought and compromised by criminals, with tens to hundreds of thousands of records exfiltrated in attacks on scores of schools.

That evolution is aided by legitimate university network users. More than half of the administrators surveyed by InfoBlox say that 25% of students arrive on campus with their devices carrying malware. "The 25% infected rate shows the devices that students are bringing from home," Danevich says. "It's not laptops. It's IoT devices [and] mobile devices." For university security teams, the implication is simple. "You can't take a look at the security once a year. You have to be much more current because it changes so fast," he explains.

While students are a common infection vector, they are not the ultimate target. "Business applications, such as HR, Financial and Campus Solutions by PeopleSoft or other vendors, are the main target, as they store the most critical data and are vulnerable to both hackers and malicious insiders," the EdGuards paper states.

University security teams hamstring themselves when they see security as a traditional perimeter game because new devices and techniques simply bypass classic perimeter defenses, Danevich says. He recommends defense at the network perimeter, in-network control, and thorough, constant monitoring with automated assistance.

"You can put up a blacklist, but now it has to be taken a step farther with a collection of information that's come from a variety of devices hooked to a SEIM and passed to a Splunk or ArcSight," he says. Ultimately, he explains, "We need to use more machine learning and be smarter with what we do."

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

It is not really that shocking to know that educational institutions have a higher tendency to be lax in their security measures as compared to organisations from various other fields. This is because of the nature of their operations which is considered to be less risky in comparison against other sectors like finance. This makes them even more vulnerable to attacks which usually come unexpectedly.

By now, every school system should not be running on old technology. As stated, level of attacks is growing. They're becoming more sophisticated, and schools need to be on top of it. This also requires a good security team with skills to support them. Too many don't pay attention, get comfortable or aren't following basic procedures. Of course, you can't be 100% secured, but if higher education security is still a problem, something is wrong here. Budget shouldn't be the reason either. Colleges and Universities make so much money! If so, this leads to even more than just a security problem. As for students, they should have security awareness training while their attending college. It should be part of their curriculum and required to pass it. In my experience, I deal with users without any decent knowledge. For example, passwords are still weak, mind sets are still on "I will never get hacked" mode, and so many more! The lack of awareness and training carries over. Again, there needs to be change and those with higher voices can make this happen.

I think the problem here is that universities don't have the money to keep upgrading their systems. I don't think it's because they don't want to keep their facilities protected, but the price that's involved in maintaining the network is very high! Unless they can source the protection to some computing studies students....

Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.

An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy i...